US Government Is Still In Turmoil Over Cyber Defense

The giant OPM Hack of 2014 reverberates as the US Government finds that it still lacks the fundamentals of a robust cyber-defense.

The White House Office of Personnel Management has recently published a report, which is depressing news for an agency that has been in more-or-less continuous turmoil since a devastating cyber-attack in March 2014. 

That attacks stole the sensitive personal information of some 25 million US government employees, including millions of security clearance files, from the agency files and those of two of its important contractors. The fingerprint data of some 5.6 millions of those employees was also stolen. 

According to a scathing report on the break-in published two months ago by the Republican majority on the House Committee on Oversight and Government Reform, the intelligence value of the theft, carried out from China, “cannot be overstated, nor will it ever be fully known.”  

The report notes that the agency is still suffering from high staff turnover in sensitive info-security jobs and top management, including five Chief Information Officers in three years, as well as longstanding failures to check security controls on computer systems to make sure they are adequate.

It is also lethargic in dealing with a variety of longstanding security weaknesses and has still not taken action on scores of security recommendations laid out in previous Inspector General reports, some made years before the catastrophic hack. 

Among other things, the report notes that only two of the agency’s major computer applications comply with the government’s own standards for verifying user identities, which date back to 2012.

Among the 18 “major” computer systems that have not been given a renewed OK on their security controls, the report notes, are five that are owned by the Chief Information Officer, two that belong to the chief financial officer, and four systems that were inherited by a newly amalgamated National Background Investigation Bureau, a reformed chunk of the bureaucracy that now operates under the Department of Defense.

One of the systems is also owned by the Office of the Inspector General.  Indeed, according to the report, OPM, despite “several initiatives underway,” still lacks a full inventory of its many servers, databases and software, let along the important issue of how they are linked with each other, fundamentals of a robust cyber-defense.

The report drily notes that lack of what it calls a “mature inventory system significantly hinders OPM’s efforts related to oversight, risk management, and securing the agency’s information systems.”

In another section, the document observes that even when OPM scanning turns up less-than-critical weaknesses, the agency does not track the efforts made to correct them, “there is a significantly increased risk that these weaknesses will not be addressed in a timely manner, and that the systems will indefinitely remain susceptible to attack.” 

To fix the problems, or at least address them, the audit report offers up a barrage of 26 recommendations, with notes alongside many of them to show they are repeats of recommendations made years before. 

For its part, the agency management concurs with almost all of them, including new staffing hires and appropriate inventories. It balked slightly, however, at a diffident suggestion that the Director of OPM, currently, Acting Director Beth Colbert, “consider shutting down information systems that do not have a current and valid [security] Authorisation.”   

The agency said it would prefer to make its own “risk-based decision” on whether to keep operating a system without that clearance, then forward it’s evaluation to the OPM head for “ultimate decision.” 

Perhaps that is progress: The Inspector General first made the shut-down suggestion in 2014, the year of the great cyber-theft, without any apparent effect. 

Fox News:      US Navy Personnel Data Breached:  

 After The OPM Hack Security Clearances Will Now Be Done By The Pentagon:

 

 

« On Facebook, Fake US Election News Was More Popular Than Real News
Irish Law Firms Experience 50% Increase In Cyberattacks »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

CSR Privacy Solutions

CSR Privacy Solutions

CSR Privacy Solutions is a leading provider of privacy regulatory compliance programs for small and medium sized businesses.

Virsec Systems

Virsec Systems

Virsec detects and remediates previously “indefensible” advanced memory-based attacks on critical applications and server endpoints.

Precise Biometrics

Precise Biometrics

Precise Biometrics develop and sell fingerprint software for convenient and secure authentication of people’s identity in mobile devices, smart cards and other products with fingerprint sensors.

Fidus Information Security

Fidus Information Security

Fidus is a team of security professionals providing Penetration Testing and Cyber Security Consulting services throughout the UK and worldwide.

Horangi

Horangi

Horangi provides security products and services that enable the rapid delivery of Incident Response and threat detection for our customers who lack the scale, expertise, or time to do it themselves.

Expanse

Expanse

Expanse SaaS-delivered products plus service expertise reduce your internet edge risk to prevent breaches and successful attacks.

CyberInsureOne

CyberInsureOne

At CyberInsureOne, we break down the complex world of cyber insurance, and connect you with providers that can give you and your company peace of mind.

Blockchains LLC

Blockchains LLC

Blockchains is committed to changing the world for the better. Using blockchain and other innovative technologies, we’ll build new systems, new security, and new interactions.

INFRA Security & Vulnerability Scanner

INFRA Security & Vulnerability Scanner

INFRA is a powerful platform with an easy interface for any kind of Ethical Hacking, from corporate monitoring and VAPT (vulnerability assessments and penetration testing) to military intelligence.

Baxter Clewis Consulting

Baxter Clewis Consulting

Baxter Clewis are cyber security and compliance experts. We provide Security Consulting, IT Assurance, and Technical Security services.

Cyber Security Canada

Cyber Security Canada

Cyber Security Canada is an accredited Certification Body for government-backed Cyber Security Certification Programs, designed specifically for small and medium-sized Canadian businesses.

Easy Dynamics

Easy Dynamics

Easy Dynamics is a leading technology services provider with a core focus in Cybersecurity, Cloud Computing, and Information Sharing.

Ibento Global

Ibento Global

Ibento organises the CyberX series of cybersecurity conferences.

Bright Data

Bright Data

Bright Data Inc is the world’s #1 web data platform, enabling organizations to research, monitor, analyze data, and make better decisions.

Icon Information Systems (ICONIS)

Icon Information Systems (ICONIS)

ICONIS is an integrated infrastructure and service provider, offering unified Information Technology (IT) solutions globally.

SafeLiShare

SafeLiShare

SafeLiShare’s data security platform unifies encryption strategies for organizations with hybrid and multi-cloud infrastructures, ensuring data is secure regardless of its location.